Splunk Join help

[splunker9999]

Hi, We are looking to join INDICATOR VALUE from lookup table to the search and needs to find out if a value is same.

Below is sample query I am currently doing:

 |inputlookup IOC.csv
|eval INDICATOR_VALUE=replace(INDICATOR_VALUE,"[\[\]]","")
|fields INDICATOR_VALUE
|join type=left INDICATOR_VALUE[search index=bank_nagw_preprod sourcetype=access_log clientip=*
|dedup clientip
|table clientip
|rename clientip as INDICATOR_VALUE
|fields INDICATOR_VALUE]

Thanks

[Raschko]

Doesn't the following search already delivers what you want?

search index=bank_nagw_preprod sourcetype=access_log
[ | inputlookup IOC.csv | eval INDICATOR_VALUE=replace(INDICATOR_VALUE,"[\[\]]","") |fields INDICATOR_VALUE | rename INDICATOR_VALUE AS clientip ]

[Raschko]

Without using "join".